From 2bf657c025a593270e0ccbe5e8e2299355f8cf92 Mon Sep 17 00:00:00 2001 From: NeilBrown Date: Thu, 27 Jun 2019 11:18:36 -0400 Subject: [PATCH] LU-12101 socklnd: fix infinite loop in ksocknal_push() If the list_for_each_entry() loop in ksocknal_push() ever finds a match, then it will increment 'i', and the outer loop will continue. Once peer_off becomes larger than the number of matches in a given chain, 'peer_ni' will be an invalid pointer, and ksocknal_push_peer() will probably crash when called on it. To abort the outer loop properly, we need to test if "i <= peer_off", which indicates that all patching peers have been found. This bug can easily be reproduced by running lctl --net tcp push Signed-off-by: Mr NeilBrown Change-Id: I9468214c7e1a0154213586cac0deb61afaa1d53d Reviewed-on: https://review.whamcloud.com/34499 Tested-by: jenkins Tested-by: Maloo Reviewed-by: James Simmons Reviewed-by: Sonia Sharma Reviewed-by: Oleg Drokin --- lnet/klnds/socklnd/socklnd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lnet/klnds/socklnd/socklnd.c b/lnet/klnds/socklnd/socklnd.c index 6eb56d0..efe5603 100644 --- a/lnet/klnds/socklnd/socklnd.c +++ b/lnet/klnds/socklnd/socklnd.c @@ -1936,7 +1936,7 @@ ksocknal_push(struct lnet_ni *ni, struct lnet_process_id id) } read_unlock(&ksocknal_data.ksnd_global_lock); - if (i == 0) /* no match */ + if (i <= peer_off) /* no match */ break; rc = 0; -- 1.8.3.1